mirror/nanobot
1
0
Fork 0
mirror of https://github.com/HKUDS/nanobot.git synced 2026-08-15 16:49:24 +03:00
Code Issues Packages Projects Releases Wiki Activity
3,908 Commits 37 Branches 19 Tags
abfcdd481a503fea8248d25a036d82a4d51c5917
Commit Graph
3908 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Xubin Ren abfcdd481a fix(cli): validate Windows subprocess environment 2026-08-12 02:57:48 +09:00
LHMQ878andXubin Ren a0e60116a3 fix(cli): stop leaking API keys to CLI app subprocesses 
Installed CLI apps were started with os.environ.copy(), so provider keys
from the parent process were visible to untrusted binaries. Use a minimal
allowlist env matching the shell tool.

Fixes #4783
 2026-08-12 02:57:48 +09:00
LHMQ878andXubin Ren ec3dfb21ba fix(cli): stop leaking API keys to CLI app subprocesses 
Installed CLI apps were started with os.environ.copy(), so provider keys
from the parent process were visible to untrusted binaries. Use a minimal
allowlist env matching the shell tool.

Fixes #4783
 2026-08-12 02:57:48 +09:00
Xubin Ren 72d3ce6b23 fix(skills): make PNG weather example Windows-safe 2026-08-12 02:48:03 +09:00
Kail TianandXubin Ren b14ac4c401 fix(skills): make weather workflow Windows-safe 2026-08-12 02:48:03 +09:00
LHMQ878andXubin Ren f5cf4dcd2c fix(providers): stop writing API keys into process os.environ 
OpenAICompatProvider already passes api_key into AsyncOpenAI. Mutating
shared os.environ leaked credentials across providers (gateway overwrite
and setdefault first-writer-wins).

Fixes #4784
 2026-08-12 02:35:40 +09:00
Wesley ZhangandXubin Ren 99e07e138e fix(tools): reject non-finite number parameters 2026-08-12 02:25:20 +09:00
yu-xin-candXubin Ren 057e8f7af6 fix(matrix): isolate thread sessions 2026-08-12 02:15:17 +09:00
chengyongruandGitHub d45c893f68 fix(webui): surface MCP runtime connection failures (#5331) 2026-08-11 23:52:02 +08:00
chengyongruandchengyongru 1edfd268db fix(webui): regenerate PWA icons from SVG 2026-08-11 20:59:06 +08:00
moranandchengyongru c0e8b8afff feat(webui): polish iOS PWA presentation 
- Disable pinch/double-tap zoom via the viewport meta (system-level
  accessibility zoom is unaffected).
- Add viewport-fit=cover so standalone mode renders edge-to-edge; the
  layout already uses env(safe-area-inset-*) from #4693.
- Add apple-mobile-web-app-* metas for standalone launch, status bar, and
  home screen label on iOS.
- Prevent double-tap zoom and orientation text inflation via inline CSS.
 2026-08-11 20:59:06 +08:00
moranandchengyongru 95287f7435 fix(webui): harden PWA service worker caching and registration 
- Exclude /webui/* endpoints from the service worker cache; the
  /webui/bootstrap endpoint issues fresh gateway credentials on every load
  and must never be cached or replayed offline.
- Restrict cache-first handling to hashed /assets/ files (served immutable).
  Un-hashed brand icons and the favicon stay network-first so future icon
  swaps reach installed clients.
- Prune stale hashed assets whenever the app shell refreshes, so old build
  assets cannot accumulate even when sw.js itself is unchanged.
- Serve the cached app shell for offline deep-link navigations.
- Ignore service worker registration failures; add unit tests for the
  service worker and the main-entry registration.
 2026-08-11 20:59:06 +08:00
zpljd258andchengyongru 43ca12960b feat(webui): add PWA support for mobile home screen installation 
- Add manifest.json with icons for install prompt
- Add service worker with cache-first for static assets
- Register SW in main.tsx
- Link manifest in index.html
 2026-08-11 20:59:06 +08:00
Xubin Ren 7703cd22eb test(websocket): wait for server readiness 2026-08-11 20:16:24 +09:00
Xubin Ren 247c474e64 perf(plugins): cache verified skill roots 2026-08-11 20:16:24 +09:00
Xubin Ren 86c7508607 docs(plugins): clarify unified extension model 2026-08-11 20:16:24 +09:00
Xubin Ren a2979c3a4b fix(plugins): harden activation boundaries 2026-08-11 20:16:24 +09:00
Xubin Ren d5e0df6963 feat(plugins): integrate portable Agent Plugins 2026-08-11 20:16:24 +09:00
chengyongruandGitHub 57d81bc1cd fix(providers): preserve nanobot tools with OpenRouter server tools (#5335) 
* fix(providers): preserve functions with extra body tools

* docs(providers): clarify extra body tool merging
 2026-08-11 18:23:27 +08:00
chengyongruandchengyongru 3778e7e628 fix(webui): soften form control focus rings 2026-08-11 14:39:07 +08:00
chengyongruandchengyongru cac39477ba test(webui): await lazy settings import deterministically 2026-08-11 13:59:22 +08:00
chengyongruandchengyongru eab017766b refactor(webui): split settings frontend by domain 2026-08-11 13:27:19 +08:00
chengyongruandGitHub 52e0a6a1e3 refactor(webui): split settings backend by domain (#5323) 2026-08-11 11:23:27 +08:00
chengyongruandGitHub 8e77f3f8a4 feat(mcp): add browser OAuth for remote servers (#5316) 2026-08-10 23:44:37 +08:00
chengyongruandchengyongru b3b0517611 fix(files): reject no-op edits 2026-08-10 21:39:00 +08:00
chengyongruandGitHub c281e090d0 refactor(webui): make gateway own settings services (#5321) 2026-08-10 18:10:55 +08:00
chengyongruandGitHub 85a452e5c7 refactor(agent): replace reflective runtime state access (#5319) 2026-08-10 16:44:26 +08:00
chengyongruandchengyongru 05d73803e7 refactor(webui): extract event projection helpers 2026-08-10 16:24:07 +08:00
chengyongruandchengyongru 5d733b1c7c fix(webui): move mutations to authenticated websocket requests 2026-08-10 16:23:47 +08:00
chengyongruandGitHub 71a99b0780 fix(webui): improve UX recovery and empty states (#5315) 2026-08-10 15:22:25 +08:00
chengyongruandchengyongru 43511decc9 fix(weixin): install QR code dependency 2026-08-10 13:48:49 +08:00
chengyongruandchengyongru 8dd2059be3 fix(weixin): require fresh credentials for forced login 2026-08-10 13:48:49 +08:00
KDBandchengyongru 7b1646f58c fix(weixin): honor forced QR login 2026-08-10 13:48:49 +08:00
chengyongruandchengyongru e620944150 fix(mcp): clean up failed HTTP connections 2026-08-10 13:15:04 +08:00
chengyongruandGitHub 66316f21da docs: refresh WebUI user guidance (#5312) 2026-08-10 11:47:58 +08:00
chengyongruandGitHub 55ecda275d test: strengthen user-path coverage and CI gates (#5308) 2026-08-09 21:37:06 +08:00
chengyongruandGitHub 411d6061ae fix(webui): explain HTTPS requirement for voice input (#5304) 2026-08-09 21:17:57 +08:00
Xubin Ren af52fbcbc4 fix(webui): emphasize temporary chat expiry 2026-08-08 23:20:59 +08:00
Xubin Ren 92eb91338a fix(webui): label temporary chat guidance 2026-08-08 23:20:59 +08:00
Xubin Ren c410ea444c fix(agent): stop session-owned exec processes 2026-08-08 23:20:59 +08:00
chengyongruandXubin Ren 8e04f12720 fix(webui): name temporary chats from first message 2026-08-08 23:20:59 +08:00
chengyongruandXubin Ren 516ae11c33 fix(webui): simplify temporary chat closing 2026-08-08 23:20:59 +08:00
chengyongruandXubin Ren 656e0d606b fix(webui): tighten temporary chat close action 2026-08-08 23:20:59 +08:00
chengyongruandXubin Ren 75e333a3c5 fix(webui): derive temporary chats from session policy 2026-08-08 23:20:59 +08:00
chengyongruandXubin Ren a5bc3bfbb9 fix(webui): complete temporary chat mode 2026-08-08 23:20:59 +08:00
Xubin Ren c9a6145878 feat(webui): add temporary chat mode 2026-08-08 23:20:59 +08:00
chengyongruandchengyongru 113e8d67ad refactor: remove verified dead code 2026-08-08 21:10:34 +08:00
chengyongruandGitHub 4e063f5695 fix(webui): prevent image hover clipping (#5294) 2026-08-08 18:05:00 +08:00
chengyongruandchengyongru bd8d3ad5b6 fix(channels): preserve global progress defaults 2026-08-07 17:19:14 +08:00
chengyongruandGitHub 332c159b93 fix(weixin): harden protocol delivery, streaming, and login (#5263) 2026-08-07 16:53:31 +08:00